Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

Abstract

Deep neural networks (DNNs) provide excellent performance across a wide range of classification tasks, but their training requires high computational resources and is often outsourced to third parties. Recent work has shown that outsourced training introduces the risk that a malicious trainer will return a backdoored DNN that behaves normally on most inputs but causes targeted misclassifications or degrades the accuracy of the network when a trigger known only to the attacker is present. In this paper, we provide the first effective defenses against backdoor attacks on DNNs. We implement three backdoor attacks from prior work and use them to investigate two promising defenses, pruning and fine-tuning. We show that neither, by itself, is sufficient to defend against sophisticated attackers. We then evaluate fine-pruning, a combination of pruning and fine-tuning, and show that it successfully weakens or even eliminates the backdoors, i.e., in some cases reducing the attack success rate to 0% with only a 0.4% drop in accuracy for clean (non-triggering) inputs. Our work provides the first step toward defenses against backdoor attacks in deep neural networks.

References in corpus (7)

• Neural Machine Translation by Jointly Learning to Align and Translate
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Pruning Filters for Efficient ConvNets
• Defensive Distillation is Not Robust to Adversarial Examples
• Stochastic Activation Pruning for Robust Adversarial Defense
• Fine-Pruning: Joint Fine-Tuning and Compression of a Convolutional Network with Bayesian Optimization

Cited by in corpus (17)

• How To Backdoor Federated Learning
• Spectral Signatures in Backdoor Attacks
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanations
• Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers
• Entangled Watermarks as a Defense against Model Extraction
• TrojDRL: Trojan Attacks on Deep Reinforcement Learning Agents
• Design of intentional backdoors in sequential models
• Walling up Backdoors in Intrusion Detection Systems
• Light Can Hack Your Face! Black-box Backdoor Attack on Face Recognition Systems
• Helen: Maliciously Secure Coopetitive Learning for Linear Models
• How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Data
• Towards Practical Watermark for Deep Neural Networks in Federated Learning
• WAFFLE: Watermarking in Federated Learning
• Baseline Pruning-Based Approach to Trojan Detection in Neural Networks
• Hacking Neural Networks: A Short Introduction
• Scientific Calculator for Designing Trojan Detectors in Neural Networks